ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

The GCC switch -fstack-protector-all emits additional prologue and epilogue code for every function, placing a random guard (canary) value on the stack and verifying it before returning. If the canary is altered-typically by a stack-based buffer overflow-the generated check calls __stack_chk_fail, which terminates the process. The basic -fstack-protector variant protects only functions judged at risk (those with certain stack objects), -fPIC merely produces position-independent code, -O3 selects aggressive optimization settings, and -fomit-frame-pointer omits the frame pointer to free a register; none of these latter options ensure canary insertion for all functions.